Bug 2484830 (CVE-2026-41178)

Summary: CVE-2026-41178 github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: aazores, abarbaro, abuckta, akoudelk, alebedev, alizardo, amctagga, anjoseph, anpicker, aoconnor, aruklets, asatyam, bniver, ckandaga, cmah, crizzo, dakwon, dhanak, diagrawa, dkeler, dkuc, doconnor, drosa, dsimansk, dymurray, eaguilar, ebaron, eborisov, eglynn, eshamard, flucifre, gbenhaim, gmeno, gparvin, groman, hasun, ibolton, jcantril, jchui, jdobes, jfula, jhe, jjoyce, jmatsuok, jmatthew, jmontleo, jowilson, jprabhak, jpretori, jschluet, jtolenti, jvasik, kaycoth, kingland, ktsao, lball, lbragsta, lchilton, lgamliel, lhh, mbenjamin, mburns, mgarciac, mhackett, mnovotny, mstipich, mwringe, nboldt, ngough, niyer, nyancey, oaljalju, ometelka, orabin, pgaikwad, pjindal, psrna, ptisnovs, pvasanth, rblanco, rekumar, rexwhite, rhaigner, rhel-process-autobot, rjohnson, rojacob, sabiswas, sakbas, sausingh, sbratsla, sdawley, sfeifer, slucidi, sostapov, sseago, sthirugn, suppawar, syedriko, thason, twaugh, tzivkovi, vereddy, veshanka, vvoronko, watson-tool-maintainers, wenshen, whayutin, wtam, xdharmai
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in OpenTelemetry-Go. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by sending oversized or invalid baggage headers. The `Parse` function, in affected versions, failed to reject raw-length inputs, leading to excessive processing and error logging when handling these large inputs.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2515044, 2515045, 2515046, 2515047, 2515049, 2515050, 2515051, 2515052, 2515053, 2515054, 2515055, 2515058, 2515059, 2515060, 2515062, 2515063, 2515064, 2515065, 2515068, 2515069, 2515070, 2515071, 2515072, 2515073, 2515074, 2515076, 2515077, 2515078, 2515079, 2515080, 2515081, 2515082, 2515083, 2515084, 2515085, 2515086, 2515087, 2515088, 2515089, 2515090, 2515091, 2515092, 2515093, 2515094, 2515095, 2515096, 2515097, 2515100, 2515101, 2515102, 2515103, 2515104, 2515105, 2515106, 2515107, 2515108, 2515110, 2515111, 2515115, 2515116, 2515117, 2515118, 2515119, 2515120, 2515121, 2515123, 2515124, 2515125, 2515126, 2515127, 2515128, 2515129, 2515130, 2515132, 2515133, 2515135, 2515136, 2515137, 2515138, 2515139, 2515142, 2515143, 2515144, 2515145, 2515048, 2515057, 2515061, 2515066, 2515067, 2515075, 2515098, 2515099, 2515109, 2515112, 2515113, 2515114, 2515122, 2515131, 2515134, 2515140, 2517703    
Bug Blocks:    

Description OSIDB Bzimport 2026-06-04 16:01:33 UTC
OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Versions 1.42.0 and 1.44.0 fix the issue.